Circuit Breaker¶
Interrupt or restrict a coupled flow when overload signals indicate cascade risk, then re-open cautiously under feedback.
When This Archetype Applies¶
No catalog groundingNone of the structural conditions is currently represented by an accepted prime or domain-specific abstraction.
Diagnostic problem
Continued connection under a detectable danger state can propagate a local fault or overload into a larger cascade.
Applicability expression1 distinct condition
groundedpartly groundedopen
1 condition, all required.
1Required in every casenumbered 1–1
These hold no matter which pattern applies.
Threshold-detectable fault propagation · open
A connected flow can propagate a local fault or overload after a detectable danger threshold is crossed.
This proposition-sized condition was conservatively reconstructed from the authored essence_one_line, compression_statement, components fields; the source file was not modified. In this condition set, the requirement is: A connected flow can propagate a local fault or overload after a detectable danger threshold is crossed.
Other requirements and context (2)
Why these sit outside the expression
Application gate — it governs whether applying the archetype is appropriate or material, rather than defining the structural problem itself.
Solution feasibility — it describes whether the intervention can work, not whether the diagnostic problem exists.
Application gateA bounded local interruption is preferable to the prospective cascade.
This proposition-sized condition was conservatively reconstructed from the authored essence_one_line, compression_statement, components fields; the source file was not modified. In this archetype, the relevant application gate is: A bounded local interruption is preferable to the prospective cascade. It narrows when choosing or applying the archetype is warranted or decision-relevant.
Solution feasibilityThe connection can be isolated and later reset under a governed policy.
This proposition-sized condition was conservatively reconstructed from the authored essence_one_line, compression_statement, components fields; the source file was not modified. In this archetype, the relevant feasibility condition is: The connection can be isolated and later reset under a governed policy. It identifies something that must be possible or available for the intervention to be workable.
Coverage
0 of 1 conditions grounded · 1 open.
Intent¶
Preserve the viability of a coupled system under active cascading failure by severing downstream load from an overloaded upstream component, and by reducing the aggregate flow into that component until it can stabilize. The archetype does not optimize for throughput or fairness; it trades both for survival.
Structural Signature¶
This archetype is applicable when all of the following are present:
- A flow (requests, current, capital, traffic) is moving from one part of the system to another.
- An upstream or shared component is reaching a capacity constraint — utilization is climbing, latency is spiking, error rate is rising, or some equivalent saturation signal.
- There is coupling such that the failing component's degradation is being transmitted to other components rather than absorbed locally, turning a local problem into a cascade.
When those three signals co-occur, this archetype is often the right composition to reach for.
Composition¶
This archetype is assembled from three prime abstractions:
- Boundary — A controllable seam is introduced between the failing component and its callers. When the seam is "open," flow is blocked; when "closed," flow resumes. The boundary is the mechanism by which local failure is prevented from propagating.
- Sampling — Rather than admitting all inbound flow, only a representative fraction is allowed through. This is load shedding at the population level: the sacrifice of some requests so that the remainder can be served.
- Feedback — The boundary and sampling rate are not static. They are continuously adjusted in response to an observed signal (latency, error rate, queue depth) coming back from the protected component. Without feedback, the archetype is a kill switch, not a breaker.
The feedback loop is what distinguishes a circuit breaker from a simple outage: it opens when saturation is detected, closes when the downstream recovers, and re-probes cautiously rather than restoring full load instantly.
Worked Example¶
A Site Reliability Engineer facing a cascading failure in a distributed database cannot deploy new code (the pipeline is too slow and the risk of new bugs is too high). They assemble an intervention using the materials at hand:
- Boundary: activate a circuit breaker to sever the connection between the web tier and the database.
- Sampling: implement load shedding to drop 50% of incoming traffic.
- Feedback: watch the latency metrics to see if the system stabilizes.
The system recovers. The solution was not optimal — some users were dropped — but it was viable. It was constructed in minutes using universal structural concepts applied to a specific technological emergency.
The SRE did not memorize incident response; they recognized the structural signature (flow / capacity / coupling) and assembled a response.
Invariants to Preserve¶
When deploying this archetype, name what must remain true even as service is degraded. Common invariants:
- Data integrity cannot be compromised (no partial writes, no silent drops of already-acknowledged work).
- The system must be able to re-probe and recover without human intervention once downstream stabilizes.
- Rejected flow must be rejected cleanly (with a predictable error) rather than queued indefinitely.
If any of these invariants cannot be held, this archetype is the wrong composition and a different one is needed.
Failure Modes¶
- Cargo Culting — Applying "Circuit Breaker" as a vibe rather than a mechanism. If the sensor, threshold, and action loop are not concretely named, there is no feedback loop, only a hope.
- Overfitting — Forcing this archetype onto a situation where the real problem is not flow-plus-capacity-plus-coupling but something else (e.g., a data corruption issue, a correctness bug, or an authorization failure). The breaker will trigger on the wrong signal and hide the real fault.
- Static Thresholds — Treating the breaker as stateless. Without hysteresis, the breaker will oscillate between open and closed as the system hovers at saturation, producing worse behavior than no breaker at all.
Cross-Domain Instances¶
- Software (SRE) — The canonical example above. See the Netflix Hystrix / resilience4j lineage.
- Finance — Exchange-level trading halts during extreme volatility. The flow is order submission; the capacity constraint is price-discovery bandwidth; the coupling is that a disorderly market in one instrument contaminates others.
- Power Grids — Protective relays on transformers. The flow is current; the capacity constraint is thermal limits; the coupling is that an overloaded line can cascade to adjacent infrastructure.
- Human Systems — An on-call escalation policy that takes a person off rotation after repeated pages. The flow is incidents; the capacity constraint is cognitive capacity; the coupling is that a saturated responder degrades the team's overall response quality.
Related Abstractions¶
Abstractions this archetype builds on — directly (a source ingredient) or as a related pattern. Links follow the typed catalog namespace.
Built directly on (3)
- Boundary: Defines system limits.
- Feedback: Outputs influence inputs.
- Sampling (Representativeness): Representative subset selection.
Variants¶
Narrower or domain-specific specializations that share this archetype's core structure. Recognized variants are established; candidate variants are provisional.
Half-Open Recovery · risk or failure variant · likely subtype
A cautious recovery state in which limited flow is reintroduced after a breaker has opened.
- Distinct from parent: Controlled reentry is broader; this variant specifically belongs to breaker-style interruption/recovery.
- Use when: A circuit breaker has interrupted flow; The system needs limited probing before full restoration.
- Typical domains: SRE, power systems, finance, operations
- Common mechanisms: half open state, limited probe, canary reintroduction
Editorial Notes¶
Problem Classification¶
Classification: Instability, Runaway Feedback & Cascades → Coupled-Network Cascade & Spread
Problem kernel: coupled overload propagates until the flow pathway is interrupted
Rationale: Both reviewers identify the same causal center, and the frozen essence explicitly describes overload propagating through a coupled flow until temporary interruption becomes necessary. Fault containment is nearby when a failed component eliminates a whole function, but this record centers pathway-borne amplification and cascade risk rather than absence of alternate service or bounded failure domains.
Boundary considered: Fragility, Failure & Continuity Risk → Fault Containment & Bounded Service Loss
Why this classification prevailed: Cascade failure concerns disturbance spread and amplification along coupled pathways; fault containment concerns preserving essential function when a local component or partner fails.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
(placeholder for later refinement — in particular, the cross-domain list could be expanded, and the relationship to the Fault Tolerance and Fail-Safe prime abstractions deserves its own section.)